Privacy Policy

This distinction matters more than anything else on this page, because it decides who you should ask about your data.

A hotel's own account with us. When someone signs up to run a hotel on Mada Host, we decide how that information is handled. Questions about it come to us.

A guest's booking with a hotel. When a guest makes a booking, sends an enquiry or leaves a review, the hotel determines how that information is used. The hotel acts as the data controller, and Mada Host processes the information on the hotel's behalf. To correct or delete it, contact the hotel directly — they can act on it without going through us. If you cannot reach them, write to us and we will help.

From a hotel operator

• Email address and password, or your Google account if you choose to sign in with Google. Passwords are processed by our authentication provider and stored only in hashed form. Mada Host cannot retrieve or display your password.
• Your name, and a phone number and avatar if you add one.
• Which hotel you belong to and your role in it.
• For staff accounts a manager creates: a username and password, and no email address. The manager sets the initial password and can reset it later, but cannot view it.
• Subscription records: the tier, the term, the amount and a receipt reference.

From a guest of a hotel

• For a booking: name, email, phone, dates, number and type of guests, and any note you write.
• For an event enquiry: name, email or phone, event type, preferred date, guest count and message.
• For a review: the name you give and what you write.

We ask for nothing beyond what a reservation needs. We do not buy personal data, and we do not build advertising profiles.

If you choose to sign in with Google, Mada Host receives basic account information you authorize, such as your Google account identifier, name, email address and profile image. We use this information only to create and secure your Mada Host account, identify you when you sign in, and display your account profile.

We do not access your Gmail, Google Drive, contacts, calendar or any other Google service. We do not use Google account information for advertising, and we do not sell it to third parties. Authentication is handled through Google and Supabase.

You can disconnect Mada Host from your Google account at any time in your Google account settings, and you can ask us to delete your Mada Host account by writing to hello@mada.build.

We do not sell personal information, and we do not use booking information to create advertising profiles. If we introduce analytics or similar technologies, we will update this policy and provide any notices or choices required by applicable law.

We use essential browser storage to keep users signed in, maintain security and remember necessary interface preferences.

Our database and file storage are provided by Supabase, and our hosting and content delivery by Vercel. These providers may process information outside the country where the hotel or the guest is located.

We currently use the following principal service providers:

• Supabase — database, file storage, sign-in, and the authentication emails we send (confirmations and password resets).
• Vercel — hosting and delivery of every page, including custom domains.
• Google — sign-in, if you choose it, as described under Google Sign-In above. We also load fonts from Google, which means Google receives the IP address of anyone loading a page.
• api.qrserver.com — generates the QR code for a hotel's address in the dashboard. It receives the website address only, never guest information.

We do not sell personal information. Apart from the service providers described above, we disclose personal information only when required by law, necessary to protect someone's safety, or needed to establish or defend legal rights. If we add a provider — a payment processor, an email service, error monitoring or customer support — we will update this list.

Subscriptions are paid through licensed payment providers — we expect these to include PayTabs, FIB, Zain Cash and FastPay. Card payments are not yet live on the platform, and we will confirm the providers here once they are.

Card numbers, bank credentials and any similar details are entered with the payment provider and handled entirely by them. They are never sent to Mada Host and we do not store them. What we keep is the record of the subscription itself: the tier, the term, the amount and currency, which provider was used, and a receipt reference.

The provider handles your payment details under its own privacy policy and its own obligations as a regulated payment service.

A hotel's content and reservation records stay for as long as their account is open, because a hotel needs its own booking history. Close the account and we delete it, apart from what we must keep for tax and accounting.

A hotel can delete a booking, an enquiry or a review at any time. When they do, it is removed from the active database. Limited copies may remain temporarily in encrypted backups or security logs before being automatically removed.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. A hotel operator can do most of this from Settings; for anything else, write to us. If the information relates to a booking or enquiry made with a hotel, contact that hotel first because it controls how the record is used.

We aim to respond to verified requests within 30 days, although complex requests may take longer where permitted by law.

Every page is served over HTTPS. Each hotel's data is isolated at the database level, so one hotel cannot read another's bookings, guests or messages — that separation is enforced by the database itself, not only by the application.

No system is perfect. If a personal-data breach occurs, we will notify affected parties and relevant authorities when required by applicable law.

Mada Host accounts are intended for hotel operators and staff who are at least 18 years old. Guest bookings may include limited information about children, such as their number or ages, when provided by a parent or guardian for occupancy and pricing purposes.

If we change this policy we will update the date at the top. For anything that materially affects how we handle your information, we will tell account holders directly rather than quietly editing this page.

This policy is published in English, Arabic and Kurdish. The English version is the governing one: it is the text that was reviewed, and it is the text that applies if a translation differs from it.

Questions about this policy, or about your data: hello@mada.build.

For a booking or an enquiry you made with a hotel, please contact that hotel first.

Mada Host is operated by Mada Build, based in Erbil, Kurdistan Region, Iraq.